Yara rule to detect packed ColibriLoader malware.

win_colibriloader_packed.yara

rule win_packed_colibriloader : packed loader
{
  meta:
    author      = "andretavare5"
    description = "Detects packed ColibriLoader malware"
    org         = "BitSight"
    date        = "2022-09-21"
    md5         = "e0a68b98992c1699876f818a22b5b907"
    reference   = "https://malpedia.caad.fkie.fraunhofer.de/details/win.colibri"
    license     = "CC BY-NC-SA 4.0"
    
  strings:
    $str1 = "NtUnmapViewOfSct"
    $str2 = "RtlAllocateHeap"
    $str3 = "user32.dll"
    $str4 = "kernel32.dll"
                              
  condition:
    uint16(0) == 0x5A4D and // MZ
    all of them
}